@cleverclouds/auth-client 0.0.0-stage → 1.0.0

package/dist/client.js

@@ -0,0 +1,226 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CleverCloudsAuthClient = void 0;
+const crypto_js_1 = require("./crypto.js");
+const permissions_js_1 = require("./permissions.js");
+const errors_js_1 = require("./errors.js");
+class CleverCloudsAuthClient {
+    identityBaseUrl;
+    applicationSlug;
+    applicationApiKey;
+    redirectUri;
+    sessionSecret;
+    constructor(config) {
+        if (!config.applicationSlug) {
+            throw new Error('CleverCloudsAuthClient: applicationSlug is required');
+        }
+        if (!config.applicationApiKey) {
+            throw new Error('CleverCloudsAuthClient: applicationApiKey is required');
+        }
+        if (!config.redirectUri) {
+            throw new Error('CleverCloudsAuthClient: redirectUri is required');
+        }
+        this.identityBaseUrl = (config.identityBaseUrl || 'http://localhost:3000').replace(/\/+$/, '');
+        this.applicationSlug = config.applicationSlug.toLowerCase().trim();
+        this.applicationApiKey = config.applicationApiKey.trim();
+        this.redirectUri = config.redirectUri.trim();
+        this.sessionSecret = config.sessionSecret;
+    }
+    /**
+     * Generates the SSO authorization redirect URL pointing to CleverClouds Identity.
+     */
+    getAuthorizationUrl(options = {}) {
+        const url = new URL(`${this.identityBaseUrl}/api/auth/authorize`);
+        url.searchParams.set('app', this.applicationSlug);
+        url.searchParams.set('returnTo', options.returnTo || this.redirectUri);
+        if (options.state) {
+            url.searchParams.set('state', options.state);
+        }
+        return url.toString();
+    }
+    /**
+     * Generates the direct login initiation URL pointing to CleverClouds Identity.
+     */
+    getLoginUrl(options = {}) {
+        const url = new URL(`${this.identityBaseUrl}/login`);
+        url.searchParams.set('app', this.applicationSlug);
+        url.searchParams.set('returnTo', options.returnTo || this.redirectUri);
+        if (options.state) {
+            url.searchParams.set('state', options.state);
+        }
+        return url.toString();
+    }
+    /**
+     * Generates the Identity logout URL.
+     */
+    getLogoutUrl(returnTo) {
+        const url = new URL(`${this.identityBaseUrl}/api/auth/logout`);
+        if (returnTo) {
+            url.searchParams.set('returnTo', returnTo);
+        }
+        return url.toString();
+    }
+    /**
+     * Exchanges an authorization ticket with detailed success/error response.
+     */
+    async exchangeTicketDetailed(ticket) {
+        if (!ticket || typeof ticket !== 'string') {
+            return {
+                success: false,
+                error: new errors_js_1.InvalidTicketError('No authorization ticket provided'),
+            };
+        }
+        // Support monkey-patched exchangeTicket on instances (e.g. mock in unit tests)
+        if (this.exchangeTicket !== CleverCloudsAuthClient.prototype.exchangeTicket) {
+            try {
+                const res = await this.exchangeTicket(ticket);
+                if (res) {
+                    return { success: true, data: res };
+                }
+                return {
+                    success: false,
+                    error: new errors_js_1.InvalidTicketError('Invalid or expired ticket'),
+                };
+            }
+            catch (err) {
+                return {
+                    success: false,
+                    error: new errors_js_1.CleverCloudsAuthError(err?.message || 'Ticket exchange failed', 'AUTH_ERROR', 500),
+                };
+            }
+        }
+        try {
+            const res = await fetch(`${this.identityBaseUrl}/api/integration/token-exchange`, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                    'X-Application-Key': this.applicationApiKey,
+                },
+                body: JSON.stringify({
+                    ticket,
+                    applicationSlug: this.applicationSlug,
+                }),
+            });
+            const json = await res.json().catch(() => null);
+            if (!res.ok || !json?.success) {
+                const code = json?.error?.code || 'AUTH_ERROR';
+                const message = json?.error?.message || 'Ticket exchange failed';
+                if (code === 'APP_ACCESS_DENIED') {
+                    return { success: false, error: new errors_js_1.AppAccessDeniedError(message, json?.error) };
+                }
+                if (code === 'INVALID_TICKET') {
+                    return { success: false, error: new errors_js_1.InvalidTicketError(message, json?.error) };
+                }
+                if (code === 'FORBIDDEN' || code === 'UNAUTHORIZED') {
+                    return { success: false, error: new errors_js_1.InvalidCredentialsError(message, json?.error) };
+                }
+                return {
+                    success: false,
+                    error: new errors_js_1.CleverCloudsAuthError(message, code, res.status, json?.error),
+                };
+            }
+            return {
+                success: true,
+                data: {
+                    valid: true,
+                    user: json.data.user,
+                    application: json.data.application,
+                    roles: json.data.roles || [],
+                    permissions: json.data.permissions || [],
+                },
+            };
+        }
+        catch (err) {
+            return {
+                success: false,
+                error: new errors_js_1.CleverCloudsAuthError(err?.message || 'Network communication failure with Identity server', 'NETWORK_ERROR', 500),
+            };
+        }
+    }
+    /**
+     * Exchanges a single-use authorization ticket with CleverClouds Identity for
+     * the verified user profile, assigned roles, and application-scoped permissions.
+     */
+    async exchangeTicket(ticket) {
+        const result = await this.exchangeTicketDetailed(ticket);
+        return result.success ? result.data : null;
+    }
+    /**
+     * Verifies an active session token directly against CleverClouds Identity.
+     */
+    async verifySession(sessionToken) {
+        if (!sessionToken || typeof sessionToken !== 'string')
+            return null;
+        try {
+            const res = await fetch(`${this.identityBaseUrl}/api/integration/verify-session`, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                    'X-Application-Key': this.applicationApiKey,
+                },
+                body: JSON.stringify({
+                    sessionToken,
+                    applicationSlug: this.applicationSlug,
+                }),
+            });
+            const json = await res.json();
+            if (!res.ok || !json.success) {
+                return null;
+            }
+            return {
+                valid: true,
+                user: json.data.user,
+                application: json.data.application,
+                roles: json.data.roles || [],
+                permissions: json.data.permissions || [],
+            };
+        }
+        catch {
+            return null;
+        }
+    }
+    /**
+     * Encodes and cryptographically signs a session payload for storage in downstream cookies.
+     */
+    signSessionCookie(result, options = {}) {
+        if (!this.sessionSecret) {
+            throw new Error('CleverCloudsAuthClient: sessionSecret is required to sign session cookies');
+        }
+        return (0, crypto_js_1.signCookie)(result, this.sessionSecret, options);
+    }
+    /**
+     * Verifies an incoming session cookie value, enforcing HMAC integrity via sessionSecret.
+     */
+    verifySessionCookie(cookieValue) {
+        if (!cookieValue || typeof cookieValue !== 'string')
+            return null;
+        if (!this.sessionSecret) {
+            throw new Error('CleverCloudsAuthClient: sessionSecret is required to verify session cookies');
+        }
+        return (0, crypto_js_1.verifyCookie)(cookieValue, this.sessionSecret);
+    }
+    // --- Permission evaluation instance methods ---
+    hasPermission(permissions, required) {
+        return (0, permissions_js_1.hasPermission)(permissions, required);
+    }
+    hasAnyPermission(permissions, requiredList) {
+        return (0, permissions_js_1.hasAnyPermission)(permissions, requiredList);
+    }
+    hasAllPermissions(permissions, requiredList) {
+        return (0, permissions_js_1.hasAllPermissions)(permissions, requiredList);
+    }
+    hasRole(roles, roleSlug) {
+        return (0, permissions_js_1.hasRole)(roles, roleSlug);
+    }
+    hasAnyRole(roles, roleSlugs) {
+        return (0, permissions_js_1.hasAnyRole)(roles, roleSlugs);
+    }
+    // --- Permission evaluation static methods ---
+    static hasPermission = permissions_js_1.hasPermission;
+    static hasAnyPermission = permissions_js_1.hasAnyPermission;
+    static hasAllPermissions = permissions_js_1.hasAllPermissions;
+    static hasRole = permissions_js_1.hasRole;
+    static hasAnyRole = permissions_js_1.hasAnyRole;
+}
+exports.CleverCloudsAuthClient = CleverCloudsAuthClient;
+//# sourceMappingURL=client.js.map

package/dist/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":";;;AAMA,2CAAuD;AACvD,qDAM0B;AAC1B,2CAKqB;AAErB,MAAa,sBAAsB;IACjB,eAAe,CAAS;IACxB,eAAe,CAAS;IACxB,iBAAiB,CAAS;IAC1B,WAAW,CAAS;IACpB,aAAa,CAAU;IAEvC,YAAY,MAAoB;QAC9B,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;QAC3E,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACrE,CAAC;QAED,IAAI,CAAC,eAAe,GAAG,CAAC,MAAM,CAAC,eAAe,IAAI,uBAAuB,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC/F,IAAI,CAAC,eAAe,GAAG,MAAM,CAAC,eAAe,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;QACnE,IAAI,CAAC,iBAAiB,GAAG,MAAM,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC;QACzD,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;QAC7C,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC,aAAa,CAAC;IAC5C,CAAC;IAED;;OAEG;IACI,mBAAmB,CAAC,UAAmC,EAAE;QAC9D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,eAAe,qBAAqB,CAAC,CAAC;QAClE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;QAClD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC,WAAW,CAAC,CAAC;QACvE,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YAClB,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QAC/C,CAAC;QACD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;IACxB,CAAC;IAED;;OAEG;IACI,WAAW,CAAC,UAAmC,EAAE;QACtD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,eAAe,QAAQ,CAAC,CAAC;QACrD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;QAClD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC,WAAW,CAAC,CAAC;QACvE,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YAClB,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QAC/C,CAAC;QACD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;IACxB,CAAC;IAED;;OAEG;IACI,YAAY,CAAC,QAAiB;QACnC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,IAAI,CAAC,eAAe,kBAAkB,CAAC,CAAC;QAC/D,IAAI,QAAQ,EAAE,CAAC;YACb,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QAC7C,CAAC;QACD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;IACxB,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,sBAAsB,CAAC,MAAc;QAIhD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC1C,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,IAAI,8BAAkB,CAAC,kCAAkC,CAAC;aAClE,CAAC;QACJ,CAAC;QAED,+EAA+E;QAC/E,IAAI,IAAI,CAAC,cAAc,KAAK,sBAAsB,CAAC,SAAS,CAAC,cAAc,EAAE,CAAC;YAC5E,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;gBAC9C,IAAI,GAAG,EAAE,CAAC;oBACR,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;gBACtC,CAAC;gBACD,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,IAAI,8BAAkB,CAAC,2BAA2B,CAAC;iBAC3D,CAAC;YACJ,CAAC;YAAC,OAAO,GAAQ,EAAE,CAAC;gBAClB,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,IAAI,iCAAqB,CAAC,GAAG,EAAE,OAAO,IAAI,wBAAwB,EAAE,YAAY,EAAE,GAAG,CAAC;iBAC9F,CAAC;YACJ,CAAC;QACH,CAAC;QAED,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,eAAe,iCAAiC,EAAE;gBAChF,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,mBAAmB,EAAE,IAAI,CAAC,iBAAiB;iBAC5C;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,MAAM;oBACN,eAAe,EAAE,IAAI,CAAC,eAAe;iBACtC,CAAC;aACH,CAAC,CAAC;YAEH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;YAEhD,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC;gBAC9B,MAAM,IAAI,GAAG,IAAI,EAAE,KAAK,EAAE,IAAI,IAAI,YAAY,CAAC;gBAC/C,MAAM,OAAO,GAAG,IAAI,EAAE,KAAK,EAAE,OAAO,IAAI,wBAAwB,CAAC;gBAEjE,IAAI,IAAI,KAAK,mBAAmB,EAAE,CAAC;oBACjC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,gCAAoB,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;gBACnF,CAAC;gBACD,IAAI,IAAI,KAAK,gBAAgB,EAAE,CAAC;oBAC9B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,8BAAkB,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;gBACjF,CAAC;gBACD,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;oBACpD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,mCAAuB,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;gBACtF,CAAC;gBAED,OAAO;oBACL,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,IAAI,iCAAqB,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC;iBACzE,CAAC;YACJ,CAAC;YAED,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE;oBACJ,KAAK,EAAE,IAAI;oBACX,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI;oBACpB,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW;oBAClC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;oBAC5B,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE;iBACzC;aACF,CAAC;QACJ,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,IAAI,iCAAqB,CAAC,GAAG,EAAE,OAAO,IAAI,oDAAoD,EAAE,eAAe,EAAE,GAAG,CAAC;aAC7H,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,cAAc,CAAC,MAAc;QACxC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,CAAC;QACzD,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7C,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,aAAa,CAAC,YAAoB;QAC7C,IAAI,CAAC,YAAY,IAAI,OAAO,YAAY,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAEnE,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,eAAe,iCAAiC,EAAE;gBAChF,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,mBAAmB,EAAE,IAAI,CAAC,iBAAiB;iBAC5C;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,YAAY;oBACZ,eAAe,EAAE,IAAI,CAAC,eAAe;iBACtC,CAAC;aACH,CAAC,CAAC;YAEH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YAC9B,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;gBAC7B,OAAO,IAAI,CAAC;YACd,CAAC;YAED,OAAO;gBACL,KAAK,EAAE,IAAI;gBACX,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI;gBACpB,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW;gBAClC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;gBAC5B,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE;aACzC,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;OAEG;IACI,iBAAiB,CAAC,MAA0B,EAAE,UAA6B,EAAE;QAClF,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,2EAA2E,CAAC,CAAC;QAC/F,CAAC;QACD,OAAO,IAAA,sBAAU,EAAC,MAAM,EAAE,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IACzD,CAAC;IAED;;OAEG;IACI,mBAAmB,CAAC,WAAmB;QAC5C,IAAI,CAAC,WAAW,IAAI,OAAO,WAAW,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAEjE,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC,CAAC;QACjG,CAAC;QAED,OAAO,IAAA,wBAAY,EAAqB,WAAW,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;IAC3E,CAAC;IAED,iDAAiD;IAE1C,aAAa,CAAC,WAAqB,EAAE,QAAgB;QAC1D,OAAO,IAAA,8BAAa,EAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IAC9C,CAAC;IAEM,gBAAgB,CAAC,WAAqB,EAAE,YAAsB;QACnE,OAAO,IAAA,iCAAgB,EAAC,WAAW,EAAE,YAAY,CAAC,CAAC;IACrD,CAAC;IAEM,iBAAiB,CAAC,WAAqB,EAAE,YAAsB;QACpE,OAAO,IAAA,kCAAiB,EAAC,WAAW,EAAE,YAAY,CAAC,CAAC;IACtD,CAAC;IAEM,OAAO,CAAC,KAAe,EAAE,QAAgB;QAC9C,OAAO,IAAA,wBAAO,EAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAClC,CAAC;IAEM,UAAU,CAAC,KAAe,EAAE,SAAmB;QACpD,OAAO,IAAA,2BAAU,EAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IACtC,CAAC;IAED,+CAA+C;IAExC,MAAM,CAAC,aAAa,GAAG,8BAAa,CAAC;IACrC,MAAM,CAAC,gBAAgB,GAAG,iCAAgB,CAAC;IAC3C,MAAM,CAAC,iBAAiB,GAAG,kCAAiB,CAAC;IAC7C,MAAM,CAAC,OAAO,GAAG,wBAAO,CAAC;IACzB,MAAM,CAAC,UAAU,GAAG,2BAAU,CAAC;;AApPxC,wDAqPC"}

package/dist/crypto.d.ts

@@ -0,0 +1,12 @@
+import type { CookieSignOptions } from './types.js';
+/**
+ * Signs a payload with an HMAC-SHA256 signature to prevent client-side cookie tampering.
+ * Produces a URL-safe `<base64url-payload>.<base64url-hmac>` token.
+ */
+export declare function signCookie<T>(data: T, secret: string, options?: CookieSignOptions): string;
+/**
+ * Verifies an HMAC-SHA256 signed cookie token using constant-time comparison.
+ * Returns the deserialized data payload if valid and unexpired; returns null on tampering.
+ */
+export declare function verifyCookie<T>(signedValue: string, secret: string): T | null;
+//# sourceMappingURL=crypto.d.ts.map

package/dist/crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAQpD;;;GAGG;AACH,wBAAgB,UAAU,CAAC,CAAC,EAC1B,IAAI,EAAE,CAAC,EACP,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,iBAAsB,GAC9B,MAAM,CAkBR;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,CAAC,GAAG,IAAI,CAuC7E"}

package/dist/crypto.js

@@ -0,0 +1,66 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.signCookie = signCookie;
+exports.verifyCookie = verifyCookie;
+const node_crypto_1 = __importDefault(require("node:crypto"));
+/**
+ * Signs a payload with an HMAC-SHA256 signature to prevent client-side cookie tampering.
+ * Produces a URL-safe `<base64url-payload>.<base64url-hmac>` token.
+ */
+function signCookie(data, secret, options = {}) {
+    if (!secret) {
+        throw new Error('A non-empty secret is required to sign session cookies');
+    }
+    const envelope = {
+        data,
+        issuedAt: Date.now(),
+        expiresAt: options.ttlSeconds ? Date.now() + options.ttlSeconds * 1000 : undefined,
+    };
+    const payloadB64 = Buffer.from(JSON.stringify(envelope)).toString('base64url');
+    const signature = node_crypto_1.default
+        .createHmac('sha256', secret)
+        .update(payloadB64)
+        .digest('base64url');
+    return `${payloadB64}.${signature}`;
+}
+/**
+ * Verifies an HMAC-SHA256 signed cookie token using constant-time comparison.
+ * Returns the deserialized data payload if valid and unexpired; returns null on tampering.
+ */
+function verifyCookie(signedValue, secret) {
+    if (!signedValue || typeof signedValue !== 'string' || !secret) {
+        return null;
+    }
+    const parts = signedValue.split('.');
+    if (parts.length !== 2) {
+        return null;
+    }
+    const [payloadB64, providedSignature] = parts;
+    // Compute expected signature
+    const expectedSignature = node_crypto_1.default
+        .createHmac('sha256', secret)
+        .update(payloadB64)
+        .digest('base64url');
+    // Constant-time comparison using SHA-256 buffer digests to prevent length-leak timing attacks
+    const expectedHash = node_crypto_1.default.createHash('sha256').update(expectedSignature).digest();
+    const providedHash = node_crypto_1.default.createHash('sha256').update(providedSignature).digest();
+    if (!node_crypto_1.default.timingSafeEqual(expectedHash, providedHash)) {
+        return null; // Signature mismatch (tampered cookie)
+    }
+    try {
+        const rawJson = Buffer.from(payloadB64, 'base64url').toString('utf-8');
+        const envelope = JSON.parse(rawJson);
+        // Check expiration
+        if (envelope.expiresAt && Date.now() > envelope.expiresAt) {
+            return null; // Expired cookie
+        }
+        return envelope.data;
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=crypto.js.map

package/dist/crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":";;;;;AAaA,gCAsBC;AAMD,oCAuCC;AAhFD,8DAAiC;AASjC;;;GAGG;AACH,SAAgB,UAAU,CACxB,IAAO,EACP,MAAc,EACd,UAA6B,EAAE;IAE/B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IAED,MAAM,QAAQ,GAAgB;QAC5B,IAAI;QACJ,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE;QACpB,SAAS,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS;KACnF,CAAC;IAEF,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC/E,MAAM,SAAS,GAAG,qBAAM;SACrB,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC;SAC5B,MAAM,CAAC,UAAU,CAAC;SAClB,MAAM,CAAC,WAAW,CAAC,CAAC;IAEvB,OAAO,GAAG,UAAU,IAAI,SAAS,EAAE,CAAC;AACtC,CAAC;AAED;;;GAGG;AACH,SAAgB,YAAY,CAAI,WAAmB,EAAE,MAAc;IACjE,IAAI,CAAC,WAAW,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;QAC/D,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,CAAC,UAAU,EAAE,iBAAiB,CAAC,GAAG,KAAK,CAAC;IAE9C,6BAA6B;IAC7B,MAAM,iBAAiB,GAAG,qBAAM;SAC7B,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC;SAC5B,MAAM,CAAC,UAAU,CAAC;SAClB,MAAM,CAAC,WAAW,CAAC,CAAC;IAEvB,8FAA8F;IAC9F,MAAM,YAAY,GAAG,qBAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,MAAM,EAAE,CAAC;IACpF,MAAM,YAAY,GAAG,qBAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,MAAM,EAAE,CAAC;IAEpF,IAAI,CAAC,qBAAM,CAAC,eAAe,CAAC,YAAY,EAAE,YAAY,CAAC,EAAE,CAAC;QACxD,OAAO,IAAI,CAAC,CAAC,uCAAuC;IACtD,CAAC;IAED,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACvE,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAgB,CAAC;QAEpD,mBAAmB;QACnB,IAAI,QAAQ,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,SAAS,EAAE,CAAC;YAC1D,OAAO,IAAI,CAAC,CAAC,iBAAiB;QAChC,CAAC;QAED,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/errors.d.ts

@@ -0,0 +1,22 @@
+/**
+ * CleverClouds Identity SDK Error Types
+ */
+export declare class CleverCloudsAuthError extends Error {
+    readonly code: string;
+    readonly statusCode?: number;
+    readonly details?: any;
+    constructor(message: string, code?: string, statusCode?: number, details?: any);
+}
+export declare class AppAccessDeniedError extends CleverCloudsAuthError {
+    constructor(message?: string, details?: any);
+}
+export declare class InvalidTicketError extends CleverCloudsAuthError {
+    constructor(message?: string, details?: any);
+}
+export declare class InvalidCredentialsError extends CleverCloudsAuthError {
+    constructor(message?: string, details?: any);
+}
+export declare class SessionExpiredError extends CleverCloudsAuthError {
+    constructor(message?: string, details?: any);
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,qBAAa,qBAAsB,SAAQ,KAAK;IAC9C,SAAgB,IAAI,EAAE,MAAM,CAAC;IAC7B,SAAgB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpC,SAAgB,OAAO,CAAC,EAAE,GAAG,CAAC;gBAElB,OAAO,EAAE,MAAM,EAAE,IAAI,GAAE,MAAqB,EAAE,UAAU,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG;CAQ7F;AAED,qBAAa,oBAAqB,SAAQ,qBAAqB;gBACjD,OAAO,GAAE,MAA2D,EAAE,OAAO,CAAC,EAAE,GAAG;CAIhG;AAED,qBAAa,kBAAmB,SAAQ,qBAAqB;gBAC/C,OAAO,GAAE,MAAiF,EAAE,OAAO,CAAC,EAAE,GAAG;CAItH;AAED,qBAAa,uBAAwB,SAAQ,qBAAqB;gBACpD,OAAO,GAAE,MAAwE,EAAE,OAAO,CAAC,EAAE,GAAG;CAI7G;AAED,qBAAa,mBAAoB,SAAQ,qBAAqB;gBAChD,OAAO,GAAE,MAAiE,EAAE,OAAO,CAAC,EAAE,GAAG;CAItG"}

package/dist/errors.js

@@ -0,0 +1,49 @@
+"use strict";
+/**
+ * CleverClouds Identity SDK Error Types
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SessionExpiredError = exports.InvalidCredentialsError = exports.InvalidTicketError = exports.AppAccessDeniedError = exports.CleverCloudsAuthError = void 0;
+class CleverCloudsAuthError extends Error {
+    code;
+    statusCode;
+    details;
+    constructor(message, code = 'AUTH_ERROR', statusCode, details) {
+        super(message);
+        this.name = 'CleverCloudsAuthError';
+        this.code = code;
+        this.statusCode = statusCode;
+        this.details = details;
+        Object.setPrototypeOf(this, new.target.prototype);
+    }
+}
+exports.CleverCloudsAuthError = CleverCloudsAuthError;
+class AppAccessDeniedError extends CleverCloudsAuthError {
+    constructor(message = 'User does not possess access to this application', details) {
+        super(message, 'APP_ACCESS_DENIED', 403, details);
+        this.name = 'AppAccessDeniedError';
+    }
+}
+exports.AppAccessDeniedError = AppAccessDeniedError;
+class InvalidTicketError extends CleverCloudsAuthError {
+    constructor(message = 'Authorization ticket is invalid, expired, or has already been redeemed', details) {
+        super(message, 'INVALID_TICKET', 401, details);
+        this.name = 'InvalidTicketError';
+    }
+}
+exports.InvalidTicketError = InvalidTicketError;
+class InvalidCredentialsError extends CleverCloudsAuthError {
+    constructor(message = 'Invalid application API key or inactive application container', details) {
+        super(message, 'INVALID_CREDENTIALS', 403, details);
+        this.name = 'InvalidCredentialsError';
+    }
+}
+exports.InvalidCredentialsError = InvalidCredentialsError;
+class SessionExpiredError extends CleverCloudsAuthError {
+    constructor(message = 'Session has expired or was revoked by an administrator', details) {
+        super(message, 'SESSION_EXPIRED', 401, details);
+        this.name = 'SessionExpiredError';
+    }
+}
+exports.SessionExpiredError = SessionExpiredError;
+//# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":";AAAA;;GAEG;;;AAEH,MAAa,qBAAsB,SAAQ,KAAK;IAC9B,IAAI,CAAS;IACb,UAAU,CAAU;IACpB,OAAO,CAAO;IAE9B,YAAY,OAAe,EAAE,OAAe,YAAY,EAAE,UAAmB,EAAE,OAAa;QAC1F,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;QACpC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;CACF;AAbD,sDAaC;AAED,MAAa,oBAAqB,SAAQ,qBAAqB;IAC7D,YAAY,UAAkB,kDAAkD,EAAE,OAAa;QAC7F,KAAK,CAAC,OAAO,EAAE,mBAAmB,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;QAClD,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AALD,oDAKC;AAED,MAAa,kBAAmB,SAAQ,qBAAqB;IAC3D,YAAY,UAAkB,wEAAwE,EAAE,OAAa;QACnH,KAAK,CAAC,OAAO,EAAE,gBAAgB,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;QAC/C,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AALD,gDAKC;AAED,MAAa,uBAAwB,SAAQ,qBAAqB;IAChE,YAAY,UAAkB,+DAA+D,EAAE,OAAa;QAC1G,KAAK,CAAC,OAAO,EAAE,qBAAqB,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;QACpD,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AALD,0DAKC;AAED,MAAa,mBAAoB,SAAQ,qBAAqB;IAC5D,YAAY,UAAkB,wDAAwD,EAAE,OAAa;QACnG,KAAK,CAAC,OAAO,EAAE,iBAAiB,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;QAChD,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AALD,kDAKC"}

package/dist/express/index.d.ts

@@ -0,0 +1,18 @@
+import type { Request, RequestHandler } from 'express';
+import { CleverCloudsAuthClient } from '../client.js';
+import type { VerificationResult } from '../types.js';
+import type { AuthMiddlewareOptions, RequireAuthOptions, RequirePermissionOptions, HandleCallbackOptions, HandleLogoutOptions } from './types.js';
+export * from './types.js';
+/**
+ * Creates Express authentication and authorization middlewares bound to a CleverCloudsAuthClient instance.
+ */
+export declare function createAuthMiddleware(client: CleverCloudsAuthClient, options?: AuthMiddlewareOptions): {
+    cookieName: string;
+    resolveSession: (req: Request) => Promise<VerificationResult | null>;
+    requireAuth: (authOptions?: RequireAuthOptions) => RequestHandler;
+    requirePermission: (permission: string | string[], permOptions?: RequirePermissionOptions) => RequestHandler;
+    requireRole: (role: string | string[]) => RequestHandler;
+    handleCallback: (callbackOptions?: HandleCallbackOptions) => RequestHandler;
+    handleLogout: (logoutOptions?: HandleLogoutOptions) => RequestHandler;
+};
+//# sourceMappingURL=index.d.ts.map

package/dist/express/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/express/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAA0B,cAAc,EAAE,MAAM,SAAS,CAAC;AAC/E,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,KAAK,EACV,qBAAqB,EACrB,kBAAkB,EAClB,wBAAwB,EACxB,qBAAqB,EACrB,mBAAmB,EACpB,MAAM,YAAY,CAAC;AAEpB,cAAc,YAAY,CAAC;AAqB3B;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,sBAAsB,EAC9B,OAAO,GAAE,qBAA0B;;0BAcA,OAAO,KAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;gCAqC7C,kBAAkB,KAAQ,cAAc;oCAiC5D,MAAM,GAAG,MAAM,EAAE,gBAChB,wBAAwB,KACpC,cAAc;wBAkDU,MAAM,GAAG,MAAM,EAAE,KAAG,cAAc;uCA2CpB,qBAAqB,KAAQ,cAAc;mCA4E/C,mBAAmB,KAAQ,cAAc;EA4B/E"}